CVE-2024-35808: Vulnerability in linux-libc-dev package - md/dm-raid
Summary
CVE-2024-35808: In the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_m... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. The vulnerability affects the md/dm-raid functionality of the package.
Vulnerability Detail
The vulnerability (CVE-2024-35808) in the linux-libc-dev package arises from the direct invocation of md_reap_sync_thread() from raid_message() without holding the 'reconfig_mutex'. This poses a security risk as md_reap_sync_thread() can modify critical fields protected by 'reconfig_mutex'. Although holding 'reconfig_mutex' can lead to deadlocks, the current implementation is unsafe. The issue has been resolved by using stop_sync_thread() to unregister sync_thread, similar to md/raid.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the linux-libc-dev package (md/dm-raid) has been addressed in version 6.1.90-1. It is crucial to update the package to ensure the security and stability of your system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides header files and libraries for compiling C programs that use Linux kernel interfaces.
md/dm-raid is a functionality related to RAID (Redundant Array of Independent Disks) management in the Linux kernel.
The vulnerability can potentially lead to security breaches or system instability if exploited.
You can use the package manager command 'dpkg -l linux-libc-dev' to check the installed version.
No known exploit has been reported for this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
